A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attac...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.

Under --permission, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist.

This vulnerability affects Node.js main, 22.x, 24.x, and 26.x.

出典: OSV.dev (Open Source Vulnerabilities) OSV

影響パッケージ

Alpine:v3.21 nodejs

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.2-r0"}]}]

Alpine:v3.22 nodejs

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.2-r0"}]}]

Alpine:v3.23 nodejs

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.18.1-r0"}]}]

Alpine:v3.24 nodejs

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.18.1-r0"}]}]

参照URL

advisory security.alpinelinux.org